[Dshield] Possible Virus......??
lweast at leeclerk.org
Mon Mar 18 13:51:16 GMT 2002
More details please.
What type of attachment was it?
Can you get a copy of the full email source for posting and analysis?
We block all .exe .scr .vbs and several others, was this a mime
vilnerability launching the web site?
Feed me semore!
> -----Original Message-----
> From: James Jarvis [mailto:james.jarvis at quest-media.com]
> Sent: Monday, March 18, 2002 5:37 AM
> To: 'list at dshield.org'
> Subject: [Dshield] Possible Virus......??
> Hi there,
> One of my colleagues received an email from test at test.com.tw
> when the email
> was opened it launhed a web-site and commenced downloading a file - It
> didn't display the name of the file, and the download was
> cancelled before
> it was able to continue. I checked the source of the email
> (It was in HTML)
> and it pointed to a site called callin.net. The remainder of
> the email was
> all in stragnge random characters, and there was a type of
> form at the base
> of the email.
> I ran a virus scan on the computer (McCafee) and it didn't
> find anything
> unusual. Does anyone have any thoughts? It may be completely
> harmless, but I
> am not a fan of executable emails. Was thinking of sending the URL to
> McCaffee suport, for them to investigate.
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
More information about the list